Blockchain & Cryptocurrency Law in Turkey: A Practical Legal Guide for Businesses, Exchanges, Investors, and Web3 Founders (2026)
Blockchain and crypto-assets have moved from a “grey zone” into a structured regulatory framework in Turkey. For entrepreneurs, exchanges, custodians, fintechs, and international investors, the key question is no longer whether Turkey regulates crypto—لكن rather how to operate compliantly, manage risk, and structure transactions so they remain enforceable under Turkish law.
This guide explains the current legal landscape, the licensing and compliance expectations for crypto-asset service providers, AML/CFT obligations (including travel rule–style requirements and withdrawal delays), restrictions on payments, and how token projects should approach issuance, marketing, custody, consumer protection, and disputes.
Important note: This article is for general information. Crypto regulation is technical and fast-moving; always obtain case-specific advice before launching, listing, marketing, or onboarding Turkish users.
1) Turkey’s crypto legal framework at a glance
A) The core shift: “crypto-asset service providers” under capital markets supervision
In July 2024, Turkey introduced statutory definitions such as crypto asset, wallet, platform, and crypto-asset service provider, and established that crypto-asset service providers must obtain permission to be established and begin operations, with core principles to be set by the capital markets regulator.
The law also explicitly contemplates capital markets instruments being issued as crypto assets and tracked digitally, with the regulator empowered to mandate integration with the central registry infrastructure.
B) The licensing timeline (transitional period)
For providers active when the law entered into force, the system introduced notification / transition expectations and key deadlines. A widely cited compliance roadmap indicates that providers applying for establishment/operating permission must apply for an operating permit by 30 June 2025 and obtain licenses by 30 June 2026.
C) Payment use: trading is not “payment”
Turkey maintains a separate, clear line regarding the use of crypto assets in payments. A Central Bank regulation defines crypto assets (for payment-law purposes) and bans using them directly or indirectly in payments, while also restricting payment and e-money institutions from building business models that route payments through crypto.
2) Key regulators and institutions you must understand
A compliant Turkey strategy usually requires mapping your activity across capital markets, payments, AML/CFT, banking, and data protection. The main public bodies and market infrastructures include:
- Capital Markets Board of Turkey (SPK/CMB): Primary authority for crypto-asset service providers (platforms, custody entities, and other designated providers), licensing, operational rules, and market conduct.
- Central Bank of the Republic of Turkey (TCMB): Regulates payment systems and has prohibited using crypto assets in payments under its regulation.
- Financial Crimes Investigation Board (MASAK): Sets AML/CFT obligations for obliged entities, including crypto-asset service providers; introduced tightened measures such as withdrawal waiting periods and stablecoin withdrawal limits.
- Turkish Scientific and Technological Research Council (TÜBİTAK): The law links permission for service providers to meeting information-systems criteria determined in relation to TÜBİTAK technical standards.
- Banking Regulation and Supervision Agency (BDDK): Relevant where banking activities, custody via banks, or prudential issues intersect (the crypto framework also contemplates obtaining the banking regulator’s view when bank obligations are created).
- Borsa İstanbul and Takasbank: Mentioned in secondary rules as potential institutional actors in the ecosystem and may be relevant depending on structure and permissions.
- Central Registry Agency (MKK): Relevant to the tokenization / registry angle (tracking rights and possible integration requirements).
- Financial Action Task Force (FATF): Not a Turkish regulator, but a major driver behind travel-rule style expectations and enhanced crypto AML controls globally.
3) Who needs a license in Turkey?
A) If you are a “crypto-asset service provider,” assume licensing applies
The legal definition captures platforms where one or more activities such as buy/sell, initial sale/distribution, exchange, transfer, custody and similar operations occur, and entities providing custody of crypto assets or private keys.
If your business touches Turkish users, Turkish marketing channels, Turkish-language targeting, or local onboarding, you should treat licensing exposure seriously—especially because the law states that establishment and commencement of activity require permission and that unauthorized activity can trigger criminal consequences.
B) Cross-border risk: marketing into Turkey can be enough
A crucial point for international exchanges: the framework contains an explicit rule that foreign entities cannot provide crypto-asset services to Turkish residents through physical presence or by opening websites in Turkish (or similar marketing/targeting).
In practice, “Turkey-facing” indicators (Turkish UI/ads, Turkish influencers, TRY on-ramps, local campaigns, Turkey-specific support) can become compliance triggers.
4) Operational compliance expectations for platforms and custody providers
Turkey’s secondary legislation sets detailed “how-to-operate” expectations for crypto-asset service providers. A cornerstone instrument is the Communiqué on establishment and operational principles (III-35/B.1), which covers governance, organization, internal control, information systems, outsourcing, recordkeeping, customer communications, and more.
A) Governance & management: local presence matters
The communiqué requires, among other points, that the general manager be resident in Turkey and appointed full-time, with regulator involvement in senior appointments.
That means “remote-only” management models are risky; Turkey expects a real governance footprint.
B) Marketing and promotions: strict “no guaranteed returns” posture
Rules on advertising and promotions are not cosmetic—they are core investor-protection tools. Under the communiqué, communications must be objective; providers may not make misleading statements or exploit customers’ lack of knowledge, and they cannot promise guaranteed returns or protection against losses.
If your growth strategy relies on aggressive referral campaigns, yield promises, “risk-free” messaging, or celebrity promotions, you need a careful legal review before launch.
C) Records, customer communications, and auditability
Service providers must retain documents and communications relating to investor interactions (including marketing and communications) and maintain dispute/complaint records.
This has practical consequences: compliance-grade logging, customer complaint workflows, and evidence integrity (especially for dispute resolution and regulatory inspections) become mandatory capabilities.
D) Outsourcing: you can outsource, but you cannot outsource liability
The communiqué recognises outsourcing but makes clear the provider remains responsible for compliance, customer relations, and the integrity of records and systems.
If you outsource custody tech, KYC vendors, customer support, or cloud infrastructure, contracts must align with Turkish regulatory expectations and data protection rules.
5) AML/CFT in Turkey: the most operationally demanding area
A) Enhanced measures and “travel rule” direction
Turkey has tightened AML measures for crypto operations, including enhanced customer due diligence, monitoring, and information requirements in transfers—consistent with global trends. MASAK also publishes guidance and compliance documents aimed at crypto service providers.
B) Withdrawal waiting periods and stablecoin limits (MASAK General Communiqué No. 29)
One of the most concrete operational rules introduced is the waiting period for crypto withdrawals:
- Transfers must occur at least 48 hours after the acquisition/swap/deposit event;
- For first-time withdrawals, the waiting period is at least 72 hours.
Additionally, for “stable-value” crypto assets (stablecoins or stablecoin-like instruments), the communiqué applies daily and monthly limits (e.g., USD 3,000/day and USD 50,000/month equivalent), subject to specific conditions and potential adjustments.
It also requires obtaining a transaction explanation of at least a certain length (e.g., minimum character requirement) for transfers.
Why this matters: These are not “policy” statements; they force product design changes—withdrawal logic, UI disclosures, monitoring rules, and customer communications.
C) Penalties for unauthorized service activity
In addition to administrative actions, the ecosystem includes criminal exposure for unauthorized crypto-asset service activity (including individuals acting without authorization).
6) Crypto in payments: what is prohibited—and what is still possible
Turkey’s payment regulation does not ban holding or trading crypto. It specifically targets using crypto as a payment instrument and prohibits payment/e-money institutions from building models that use crypto directly or indirectly in payments.
Practical takeaway
- “Pay with crypto” at checkout is legally high-risk.
- Trading, custody, exchange services fall into the capital markets/AML side (with licensing and MASAK obligations).
- For merchants and fintechs, the safest route is usually a fiat-based payment flow, with crypto handled as a separate investment/asset activity—subject to the relevant licensing boundaries.
7) Token issuance, tokenized securities, and blockchain fundraising in Turkey
A) Not every token is treated the same
From a Turkish-law perspective, classification depends on what the token does:
- Does it grant profit participation, governance, revenue share, or rights resembling securities?
- Is it purely a utility token (access/consumption)?
- Is it a stablecoin (value-pegged)?
- Is it an NFT (unique, but may still be regulated depending on offering/marketing)?
The law also empowers the regulator to treat crypto assets that provide rights specific to capital markets instruments differently and to set rules accordingly.
B) Tokenized securities are explicitly contemplated
Turkey’s framework contemplates capital markets instruments being issued as crypto assets and tracked digitally, with legal effect tied to the electronic records of the environment where they are created and stored.
This is significant for structured finance, venture investments, and innovative capital raising—but only if you design within the regulator’s rulebook.
C) Practical structuring advice (high level)
If you are launching a token project connected to Turkey (issuer, team, target market, or Turkish investors), you should build a legal strategy around:
- Offering structure (private sale vs. public marketing)
- Disclosure (risk statements, token economics, governance, lockups)
- Listing strategy (licensed provider expectations; market conduct)
- Custody (who holds keys; segregation; insolvency risk)
- AML design (KYC level, geography blocks, sanctions screening)
- Marketing compliance (no guaranteed returns; fair, objective messaging)
8) Smart contracts under Turkish law: enforceability and evidence
Turkey does not have a single “Smart Contracts Act,” but that does not mean smart contracts are legally meaningless. The enforceability analysis typically runs through:
- General contract law principles (offer/acceptance, intent, lawful cause, impossibility, defect of consent)
- Evidence law and audit trails (hashes, logs, timestamps, key custody records)
- Consumer protection where retail users are involved
- IT and cybersecurity obligations where regulated entities operate critical infrastructure
For businesses, the key is to draft off-chain legal terms that map to on-chain logic (governing law, dispute resolution, liability, upgrade/admin keys, oracle risks, force majeure, and termination).
9) Disputes, fraud, tracing, and enforcement: what clients face in practice
Typical Turkey-related crypto disputes include:
- Exchange account freezes and withdrawal delays (now also shaped by MASAK waiting periods)
- Unauthorized access / SIM-swap / phishing losses and allocation of liability
- Token sale disputes (misrepresentation, delivery failures, vesting issues)
- Custody failures and insolvency concerns
- Influencer marketing claims and misleading advertising exposure
- Cross-border tracing (requests to foreign platforms; evidence preservation)
A strong dispute strategy blends technical forensics (transaction tracing, wallet clustering where possible), injunctive relief planning, and evidence preservation from day one.
10) Tax and accounting: proceed carefully
Crypto taxation in Turkey can be fact-dependent (individual vs. corporate, frequency, business purpose, and characterization of income). Because the classification and reporting approach can vary and the enforcement environment evolves, businesses and high-volume traders should obtain tailored tax advice and design documentation (transaction logs, valuations, wallet ownership evidence) early.
11) Compliance checklist for crypto businesses entering Turkey
If you are an exchange, custody provider, token issuer, or Web3 platform, a Turkey-ready plan often includes:
- Regulatory classification of your activity (platform? custody? issuance? marketing only?)
- Licensing pathway aligned to capital markets rules and transition deadlines
- AML/CFT program: KYC tiers, monitoring rules, suspicious transaction process, transfer information design
- Product controls implementing withdrawal waiting periods and stablecoin limits where applicable
- Marketing & promotions review (no guaranteed return claims; objective messaging; influencer contracts)
- Data protection & cybersecurity readiness (privacy notices, cross-border data transfers, incident response)
- Contract suite: platform terms, custody terms, risk disclosures, token terms, dispute clauses
- Evidence & auditability: record retention, customer comms, complaint handling
12) FAQ: common questions about crypto law in Turkey
1) Is crypto legal in Turkey?
Holding and trading crypto is not categorically banned, but key activities are regulated—especially service provision, custody, and marketing to Turkish residents.
2) Can we accept crypto as payment for goods or services?
Using crypto assets directly or indirectly in payments is prohibited under the Central Bank regulation.
3) Do exchanges and custody providers need a license?
Yes—crypto-asset service providers must obtain permission to establish and begin operations, and must follow the regulator’s secondary rules.
4) We are abroad. If we do not have an office in Turkey, can we onboard Turkish users?
Targeting Turkish residents through Turkey-facing marketing (including Turkish-language websites) can trigger prohibition/risk and should be assessed carefully.
5) Why do some platforms enforce 48–72 hour withdrawal delays?
MASAK’s General Communiqué No. 29 introduced withdrawal timing rules (48 hours generally; 72 hours for first withdrawal).
6) Are stablecoin withdrawals limited?
Yes—there are stablecoin-type withdrawal limits (daily/monthly thresholds) under MASAK’s tightened measures.
7) Are crypto ads and influencer campaigns regulated?
Yes—secondary rules include strict standards: ads must be objective, not misleading, and cannot promise guaranteed returns or loss protection.
8) Can we issue tokenized securities in Turkey?
The law contemplates issuing capital markets instruments as crypto assets and tracking rights digitally, but this must be structured under the regulator’s framework.
Yanıt yok